Specify channel binding token hardening level: registry value CBTHardeningLevelStatus and 1 moreComputerHKLM\Software\Policies\Microsoft\Windows\WinRM\Service
- Policy ID
- CBTHardeningLevel_1
- Scope
- Computer Configuration
- Supported on
- At least Windows Vista
- Source
- Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
- Category
- Windows Components › Windows Remote Management (WinRM) › WinRM Service
Registry
CBTHardeningLevelStatus
-ComputerCbtHardeningLevel
REG_SZComputer- Enabled value
- Depends on the option value
- Element
- Hardening Level:
| Item | Stored value |
|---|---|
| None | None |
| Relaxed | Relaxed |
| Strict | Strict |
Apply with .reg · CMD · PowerShell
.reg
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service] ; Options (use only one) ; None "CbtHardeningLevel"="None" ; Relaxed "CbtHardeningLevel"="Relaxed" ; Strict "CbtHardeningLevel"="Strict"
CMD
:: Options (use only one) :: None reg add "HKLM\Software\Policies\Microsoft\Windows\WinRM\Service" /v "CbtHardeningLevel" /t REG_SZ /d "None" /f :: Relaxed reg add "HKLM\Software\Policies\Microsoft\Windows\WinRM\Service" /v "CbtHardeningLevel" /t REG_SZ /d "Relaxed" /f :: Strict reg add "HKLM\Software\Policies\Microsoft\Windows\WinRM\Service" /v "CbtHardeningLevel" /t REG_SZ /d "Strict" /f
PowerShell
# Common: create the key New-Item -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Force | Out-Null # Options (use only one) # None New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Name 'CbtHardeningLevel' -PropertyType String -Value 'None' -Force | Out-Null # Relaxed New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Name 'CbtHardeningLevel' -PropertyType String -Value 'Relaxed' -Force | Out-Null # Strict New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Name 'CbtHardeningLevel' -PropertyType String -Value 'Strict' -Force | Out-Null